Call license key check. (#7594) (#7704)

* Call license key check. (#7594)

* Add CHANGELOG entry.

* Fix super user JWT token behaviour with non-ex. db. (#7656)

CHANGELOG

@@ -120,6 +120,8 @@ devel
 
 * use `-std=c++14` for ArangoDB compilation
 
+* Add license key checking to enterprise version in Docker containers.
+
 
 v3.4.0-rc.5 (XXXX-XX-XX)
 ------------------------

arangod/GeneralServer/GeneralCommTask.cpp

@@ -213,7 +213,10 @@ GeneralCommTask::RequestFlow GeneralCommTask::prepareExecution(GeneralRequest& r
       // prevent guessing database names (issue #5030)
       auth::Level lvl = auth::Level::NONE;
       if (req.authenticated()) {
-        if (_auth->userManager() != nullptr) {
+        // If we are authenticated and the user name is empty, then we must
+        // have been authenticated with a superuser JWT token. In this case,
+        // we must not check the databaseAuthLevel here.
+        if (_auth->userManager() != nullptr && !req.user().empty()) {
           lvl = _auth->userManager()->databaseAuthLevel(req.user(), req.databaseName());
         } else {
           lvl = auth::Level::RW;

arangod/RestServer/arangod.cpp

@@ -307,6 +307,12 @@ static void WINAPI ServiceMain(DWORD dwArgc, LPSTR* lpszArgv) {
 #endif
 
 int main(int argc, char* argv[]) {
+#ifdef __linux__
+#if USE_ENTERPRISE
+  arangodb::checkLicenseKey();
+#endif
+#endif
+
   TRI_GET_ARGV(argc, argv);
 #if _WIN32
   if (argc > 1 && TRI_EqualString("--start-service", argv[1])) {

tests/js/client/authentication/auth.js

@@ -513,6 +513,29 @@ function AuthSuite() {
       expect(res).to.have.property('statusCode', 401);
     },
 
+    testDatabaseGuessingSuperUser: function() {
+      let jwt = crypto.jwtEncode(jwtSecret, {
+        "server_id": "foo",
+        "iss": "arangodb", "exp": Math.floor(Date.now() / 1000) + 3600
+      }, 'HS256');
+      // should respond with not-found because we are root
+      var res = request.get({
+        url: baseUrl() + "/_db/nonexisting/_api/version",
+        auth: {
+          bearer: jwt,
+        }
+      });
+      expect(res).to.be.an.instanceof(request.Response);
+      expect(res).to.have.property('statusCode', 404);
+
+      // should prevent name guessing by unauthorized users
+      res = request.get({
+        url: baseUrl() + "/_db/nonexisting/_api/version"
+      });
+      expect(res).to.be.an.instanceof(request.Response);
+      expect(res).to.have.property('statusCode', 401);
+    },
+
     testDatabaseListNonSystem: function() {
       let jwt = crypto.jwtEncode(jwtSecret, {
         "preferred_username": "root",